Set Vary header

We use the Authorization header to determine what to show.